documentation
Get Started Free
  • Get Started Free
  • Stream
      Confluent Cloud

      Fully-managed data streaming platform with a cloud-native Kafka engine (KORA) for elastic scaling, with enterprise security, stream processing, governance.
      Confluent Platform

      An on-premises enterprise-grade distribution of Apache Kafka with enterprise security, stream processing, governance.
  • Connect
      Managed

      Use fully-managed connectors with Confluent Cloud to connect to data sources and sinks.
      Self-Managed

      Use self-managed connectors with Confluent Platform to connect to data sources and sinks.
  • Govern
      Managed

      Use fully-managed Schema Registry and Stream Governance with Confluent Cloud.
      Self-Managed

      Use self-managed Schema Registry and Stream Governance with Confluent Platform.
  • Process
      Managed

      Use Flink on Confluent Cloud to run complex, stateful, low-latency streaming applications.
      Self-Managed

      Use Flink on Confluent Platform to run complex, stateful, low-latency streaming applications.
Stream
Confluent Cloud

Fully-managed data streaming platform with a cloud-native Kafka engine (KORA) for elastic scaling, with enterprise security, stream processing, governance.
Confluent Platform

An on-premises enterprise-grade distribution of Apache Kafka with enterprise security, stream processing, governance.
Connect
Managed

Use fully-managed connectors with Confluent Cloud to connect to data sources and sinks.
Self-Managed

Use self-managed connectors with Confluent Platform to connect to data sources and sinks.
Govern
Managed

Use fully-managed Schema Registry and Stream Governance with Confluent Cloud.
Self-Managed

Use self-managed Schema Registry and Stream Governance with Confluent Platform.
Process
Managed

Use Flink on Confluent Cloud to run complex, stateful, low-latency streaming applications.
Self-Managed

Use Flink on Confluent Platform to run complex, stateful, low-latency streaming applications.
Learn
Get Started Free
  1. Home
  2. Platform
  3. Security in Confluent Platform
  4. Authentication in Confluent Platform

CONFLUENT PLATFORM

  • Overview
  • Get Started
    • Platform Overview
    • Quick Start
    • Learn More About Confluent and Kafka
    • Tutorial: Set Up a Multi-Broker Cluster
    • Scripted Confluent Platform Demo
      • Overview
      • Deploy Confluent Platform Environment
      • Deploy Hybrid Confluent Platform and Cloud Environment
      • Troubleshoot and Stop the Demo
  • Install and Upgrade
    • Overview
    • System Requirements
    • Supported Versions and Interoperability
    • Install Manually
      • ZIP and TAR
      • Ubuntu and Debian
      • RHEL, CentOS, Rocky, & Amazon Linux
      • Docker
        • Install
        • Configure
        • Image Reference
        • Security
        • Developer Guide
      • Configure Automatic Startup and Monitoring
    • Deploy with Ansible Playbooks
    • Deploy with Confluent for Kubernetes
    • License
    • Upgrade
      • Overview
      • Upgrade Procedure
    • Installation Packages
    • Migrate to Confluent Platform
    • Migrate to and from Confluent Server
    • Migrate from ZooKeeper to KRaft
  • Build Client Applications
    • Overview
    • Configure Clients
      • Consumer
      • Producer
      • Schemas, Serializers, and Deserializers
      • Configuration Properties
    • Client Guides
      • Python
      • .NET Client
      • JavaScript Client
      • Go Client
      • C++ Client
      • Java Client
      • JMS Client
        • Overview
        • Development Guide
    • Client Examples
      • Overview
      • Python Client
      • .NET Client
      • JavaScript Client
      • Go Client
      • C++ Client
      • Java
      • Spring Boot
      • KafkaProducer
      • REST
      • Clojure
      • Groovy
      • Kafka Connect Datagen
      • kafkacat
      • Kotlin
      • Ruby
      • Rust
      • Scala
    • Kafka Client APIs
      • Python Client API
      • .NET Client API
      • JavaScript Client API
      • Go Client API
      • C++ Client API
      • Java Client API
      • JMS Client
        • Overview
        • Development Guide
    • Deprecated Client APIs
    • VS Code Extension
    • MQTT Proxy
      • Overview
      • Secure Communication
      • Configure
  • Confluent REST Proxy for Apache Kafka
    • Overview
    • Quick Start
    • API Reference
    • Production Deployment
      • Overview
      • Deploy REST Proxy for Confluent Server
        • Configure REST Admin APIs
        • Configure Security
      • Deploy a Standalone REST Proxy node
        • Overview
        • Configure
        • Monitor
        • Secure REST Proxy
    • Connect to Confluent Cloud
  • ksqlDB and Kafka Streams
    • Overview
    • ksqlDB
      • Overview
      • Quick Start
      • Install
      • Operate
      • Upgrade
      • Concepts
        • Overview
        • Kafka Primer
        • Connectors
        • Events
        • Functions
        • Lambda Functions
        • Materialized Views
        • Queries
        • Streams
        • Stream Processing
        • Tables
        • Time and Windows in ksqlDB Queries
      • How-to Guides
        • Overview
        • Control the Case of Identifiers
        • Convert a Changelog to a Table
        • Create a User-defined Function
        • Manage Connectors
        • Query Structured Data
        • Test an Application
        • Update a Running Persistent Query
        • Use Variables in SQL Statements
        • Use a Custom Timestamp Column
        • Use Lambda Functions
      • Develop Applications
        • Overview
        • Joins
          • Overview
          • Join Streams and Tables
          • Partition Data
          • Synthetic Keys
        • Reference
          • Overview
          • Aggregate Functions
          • ALTER SYSTEM
          • ASSERT SCHEMA
          • ASSERT TOPIC
          • CREATE CONNECTOR
          • CREATE STREAM AS SELECT
          • CREATE STREAM
          • CREATE TABLE AS SELECT
          • CREATE TABLE
          • CREATE TYPE
          • DEFINE
          • DESCRIBE CONNECTOR
          • DESCRIBE FUNCTION
          • DESCRIBE
          • DROP CONNECTOR
          • DROP STREAM
          • DROP TABLE
          • DROP TYPE
          • EXPLAIN
          • Functions
          • INSERT INTO
          • INSERT VALUES
          • Operators
          • PAUSE
          • PRINT
          • Quick Reference
          • RESUME
          • RUN SCRIPT
          • Scalar Functions
          • SELECT (Pull Query)
          • SELECT (Push Query)
          • SHOW CONNECTORS
          • SHOW FUNCTIONS
          • SHOW PROPERTIES
          • SHOW QUERIES
          • SHOW STREAMS
          • SHOW TABLES
          • SHOW TOPICS
          • SHOW TYPES
          • SHOW VARIABLES
          • SPOOL
          • Table Functions
          • TERMINATE
          • Type Coercion
          • UNDEFINE
        • REST API
          • Overview
          • REST API Reference
          • Cluster Status
          • Info
          • Is Valid Property
          • Run SQL statements
          • Query a Stream
          • Get statement status
          • Streaming API endpoint
          • Terminate a cluster
        • Java Client
      • Operate and Deploy
        • Overview
        • Installation
          • Overview
          • Install ksqlDB
          • Install with Docker containers
          • Check Server Health
          • Configure ksqlDB Server
          • Configure Security
          • Connect the CLI to a Server
          • Integrate with Schema Registry
          • Upgrade ksqlDB
          • Legacy Documentation
        • ksqlDB Architecture
        • Capacity Planning
        • Changelog
        • Processing Guarantees
        • High Availability
        • High Availability Pull Queries
        • KSQL versus ksqlDB
        • Logging
        • Manage Metadata Schemas
        • Monitoring
        • Performance Guidelines
        • Schema Inference With ID
        • Schema Inference
      • Reference
        • Overview
        • SQL
          • Overview
          • SQL Keywords and Operators
          • Use DDL to Structure Data
          • Data Types
          • Syntax and Lexical Structure
          • Time Units and Formats
        • Metrics
        • Migrations Tool
        • Processing Log
        • Serialization Formats
        • Server Configuration Parameters
        • User-defined functions (UDFs)
      • Run ksqlDB in Confluent Cloud
      • Connect Local ksqlDB to Confluent Cloud
      • Connect ksqlDB to Control Center
      • Secure ksqlDB with RBAC
      • Frequently Asked Questions
      • Troubleshoot
      • Tutorials and Examples
        • Overview
        • How-to Guides
          • Overview
          • Control the Case of Identifiers
          • Convert a Changelog to a Table
          • Create a User-defined Function
          • Manage Connectors
          • Query Structured Data
          • Test an Application
          • Update a Running Persistent Query
          • Use Variables in SQL Statements
          • Use a Custom Timestamp Column
          • Use Lambda Functions
        • Materialized View
        • Streaming ETL Pipeline
        • Event-Driven Microservice
        • Build Clickstream Data Analysis Pipeline
    • Kafka Streams
      • Overview
      • Streams API
      • Tutorial: Streaming Application Development Basics on Confluent Platform
      • Connect Streams to Confluent Cloud
      • Concepts
      • Architecture
      • Examples
      • Developer Guide
        • Overview
        • Write a Streams Application
        • Configure
        • Run a Streams Application
        • Test
        • Domain Specific Language
        • Name Domain Specific Language Topologies
        • Optimize Topologies
        • Processor API
        • Data Types and Serialization
        • Interactive Queries
        • Memory
        • Manage Application Topics
        • Security
        • Reset Streams Applications
      • Build Pipeline with Connect and Streams
      • Operations
        • Plan and Size
        • Monitor
      • Upgrade
      • Frequently Asked Questions
      • Javadocs
  • Process Data With Flink
    • Overview
    • Get Started
    • Installation and Configuration
      • Installation Overview
      • Versions and Interoperability
      • Features and Support
      • Install with Helm
      • Configure Authorization
      • Configure Authentication
    • Architecture and Features
      • Overview
      • Understand Flink
      • Confluent Manager for Apache Flink
      • Environments
      • Applications
    • Operations
      • Operations
      • Manage with CFK
      • Manage Access Control
      • Use REST APIs
      • Use CLI Operations
    • Flink Jobs
      • Overview
      • Manage Security
      • Package Flink Jobs
      • Configure Logging
      • Collect Metrics
      • How to Checkpoint to S3
    • Get Help
    • What’s New
  • Connect to External Systems
    • Overview
    • Get Started
    • Connectors
    • Confluent Hub
      • Overview
      • Component Archive Specification
      • Contribute
    • Connect on z/OS
    • Install
    • License
    • Supported
      • Supported Self-Managed Connectors
      • Supported Connector Versions till Confluent Platform 7.8
    • Preview
    • Configure
    • Monitor
    • Logging
    • Connect to Confluent Cloud
    • Developer Guide
    • Tutorial: Moving Data In and Out of Kafka
    • Reference
      • Kafka Connect Javadocs
      • REST interface
      • Kafka Connect Worker Configuration Properties for Confluent Platform
      • Connector Configuration Properties for Confluent Platform
    • Transform
    • Custom Transforms
    • Security
      • Kafka Connect Security Basics
      • Kafka Connect and RBAC
        • Get Started With RBAC and Kafka Connect
        • Configure RBAC for a Connect Cluster
        • Configure RBAC for a Connect Worker
        • RBAC for self-managed connectors
        • Connect Secret Registry
        • Example Connect role-binding sequence
      • Manage CSFLE in Confluent Cloud for Self-Managed Connectors
    • Design
    • Add Connectors and Software
    • Install Community Connectors
    • Upgrade
    • Troubleshoot
    • FileStream Connectors
    • FAQ
  • Manage Schema Registry and Govern Data Streams
    • Overview
    • Get Started with Schema Registry Tutorial
    • Install and Configure
      • Install
      • Configure Schema Registry
      • Configure Clients to Schema Registry
      • Deploy in Production
      • Deployment Architectures
      • Use Schema Registry to Migrate Schemas in Confluent Platform
    • Fundamentals
      • Concepts
      • Schema Evolution and Compatibility
      • Schema Formats
        • Serializers and Deserializers Overview
        • Avro
        • Protobuf
        • JSON Schema
      • Data Contracts
    • Manage Schemas
      • Overview
      • Schema Contexts
      • Link Schemas
      • Validate Schema IDs
      • Monitor
      • Delete Schemas
      • Integrate Schemas from Connectors
    • Security
      • Overview
      • Configure Role-Based Access Control
      • Configure OAuth
      • Schema Registry Security Plugin
        • Overview
        • Install
        • Schema Registry Authorization
          • Operation and Resource Support
          • Role-Based Access Control
          • ACL Authorizer
          • Topic ACL Authorizer
    • Reference
      • Overview
      • Maven Plugin
      • API
      • API Examples
    • FAQ
  • Manage Security
    • Overview
    • Deployment Profiles
    • Authenticate
      • Overview
      • Mutual TLS
        • Overview
        • Use Principal Mapping
      • OAuth/OIDC
        • Overview
        • Claim Validation for OAuth JWT tokens
        • OAuth/OIDC Service-to-Service Authentication
        • Configure Confluent Server Brokers
        • Configure Confluent Schema Registry
        • Configure Metadata Service
        • Configure Kafka Connect
        • Configure Confluent Control Center
        • Configure REST Proxy
        • Configure Truststores for TLS Handshake with Identity Providers
        • Migrate from mTLS to OAuth Authentication
      • Multi-Protocol Authentication
        • Overview
        • Use AuthenticationHandler Class
      • REST Proxy
        • Overview
        • Principal Propagation for mTLS
      • SSO for Confluent Control Center
        • Overview
        • Configure OIDC SSO for Confluent Control Center
        • Configure OIDC SSO for Confluent CLI
        • Troubleshoot
      • HTTP Basic Authentication
        • Overview
      • SASL
        • Overview
        • SASL/GSSAPI (Kerberos)
          • Overview
        • SASL/OAUTHBEARER
          • Overview
          • Configure Confluent Server Brokers
          • Configure Clients
        • SASL/PLAIN
          • Overview
        • SASL/SCRAM
          • Overview
      • LDAP
        • Overview
        • Configure Kafka Clients
      • Delegation Tokens
        • Overview
    • Authorize
      • Overview
      • Access Control Lists
        • Overview
        • Manage ACLs
      • Role-Based Access Control
        • Overview
        • Quick Start
        • Use mTLS with RBAC
        • Configure mTLS with RBAC
        • Deployment Patterns for mTLS with RBAC
        • RBAC using REST API
        • Cluster Identifiers
        • Use Centralized ACLs with MDS for Authorization
        • Client Flow for OAuth-OIDC using RBAC
        • Request Forwarding with mTLS RBAC
        • Deploy Secure ksqlDB with RBAC
        • Metadata API
        • Predefined RBAC Roles
        • Enable RBAC on Running Cluster
        • Migrate LDAP to OAuth for RBAC
        • Example of Enabling RBAC
      • LDAP Group-Based Authorization
        • Configure LDAP Group-Based Authorization
        • LDAP Configuration Reference
        • Tutorial: Group-Based Authorization Using LDAP
        • Configure Confluent Server Authorizer in Confluent Platform
    • Protect Data
      • Overview
      • Protect Data in Motion with TLS Encryption
      • Redact Confluent Logs
    • Secure Components
      • Overview
      • Confluent Control Center
        • Secure Confluent Control Center
          • Overview
          • Configure TLS
          • Configure SASL
          • Configure HTTP Basic Authentication
          • Configure LDAP
          • Configure RBAC
          • Authorize with Kafka ACLs
          • Manage and View RBAC Roles
            • Sign in to Control Center (Legacy) when RBAC enabled on Confluent Platform
            • Manage RBAC roles with Control Center (Legacy) on Confluent Platform
            • View your RBAC roles in Control Center (Legacy) on Confluent Platform
          • Add new Basic auth with c3++ Prometheus and Alertmanager
      • Schema Registry
      • Kafka Connect
      • KRaft Security
      • ksqlDB RBAC
      • REST Proxy
        • Deploy Secure Standalone REST Proxy in Confluent Platform
        • REST Proxy Security Plugins in Confluent Platform
      • ZooKeeper
    • Compliance
      • Overview
      • Audit Logs
        • Audit Logs Concepts
        • Auditable Events
        • Configure Audit Logs Using Confluent CLI
        • Configure MDS to Manage Centralized Audit Logs
        • MDS API Audit Log Configuration
        • Use Properties Files to Configure Audit Logs in Confluent Platform
      • Manage Secrets
        • Overview
        • Tutorial: Protect Secrets
    • Configure Security Properties using Prefixes
    • Add Security to Running Clusters
    • Enable Security for a ZooKeeper-Based Cluster
    • Configure Confluent Server Authorizer
    • Security Management Tools
      • Ansible Playbooks for Confluent Platform
      • Deploy Secure Confluent Platform Docker Images
    • Cluster Registry
  • Deploy Confluent Platform in a Multi-Datacenter Environment
    • Overview
    • Multi-Data Center Architectures on Confluent Platform
    • Cluster Linking on Confluent Platform
      • Overview
      • Tutorials
        • Share Data Across Topics
        • Link Hybrid Cloud and Bridge-to-Cloud Clusters
        • Migrate Data
      • Manage
        • Manage Mirror Topics
        • Configure
        • Command Reference
        • Monitor
        • Security
      • FAQ
      • Troubleshooting
    • Multi-Region Clusters on Confluent Platform
      • Overview
      • Tutorial: Multi-Region Clusters
      • Tutorial: Move Active-Passive to Multi-Region
    • Replicate Topics Across Kafka Clusters in Confluent Platform
      • Overview
      • Example: Active-active Multi-Datacenter
      • Tutorial: Replicate Data Across Clusters
      • Tutorial: Run as an Executable or Connector
      • Configure
      • Verify Configuration
      • Tune
      • Monitor
      • Configure for Cross-Cluster Failover
      • Migrate from MirrorMaker to Replicator
      • Replicator Schema Translation Example for Confluent Platform
  • Configure and Manage
    • Overview
    • Configuration Reference
      • Overview
      • Configure Brokers and Controllers
      • Configure Topics
      • Configure Consumers
      • Configure Producers
      • Configure Connect
        • Overview
        • Configure Sink Connectors
        • Configure Source Connectors
      • Configure AdminClient
      • Configure Licenses
      • Configure Streams
    • Control Center
      • Overview
      • Manage
        • Overview
        • Configuration Examples
        • Configuration Reference
        • Manage Licenses
        • Monitor
        • Manage Logs
        • Manage Updates
        • Upgrade
        • Troubleshoot
        • Connect to Cloud
        • Install on Apache Kafka
      • Manage Clusters
      • Manage Brokers
      • Manage Topics
        • Overview
        • Create Topics
        • Topic Metrics
        • View Messages
        • Configure Topics
        • Delete Topics
      • Connect
      • ksqlDB
      • Consumers
      • Copy Topics
      • Alerts
        • Overview
        • Manage Alerts
        • Configure Alerts
        • Manage Triggers
        • Manage Actions
        • Configure PagerDuty
        • REST API
        • Usage Examples
        • Troubleshoot
    • CLI Tools for Use with Confluent Platform
      • Bundled CLI Tools
      • Confluent CLI
      • Generate Diagnostics
      • kcat (formerly kafkacat) Utility
    • Change Configurations Without Restart
    • Manage Clusters
      • Overview
      • Cluster Metadata Management
        • Overview
        • KRaft Overview
        • Configure KRaft
        • Configure ZooKeeper
      • Manage Self-Balancing Clusters
        • Overview
        • Quick Start
        • Tutorial: Adding and Remove Brokers
        • Configure
        • Performance and Resource Usage
      • Auto Data Balancing
        • Overview
        • Quick Start
        • Tutorial: Add and Remove Brokers
        • Configure
      • Tiered Storage
    • Metadata Service (MDS) in Confluent Platform
      • Configure MDS
      • Configure Communication with MDS over TLS
      • Configure mTLS Authentication and RBAC for Kafka Brokers
      • Configure Kerberos Authentication for Brokers Running MDS
      • Configure LDAP Authentication
      • Configure LDAP Group-Based Authorization for MDS
      • MDS as token issuer
      • Metadata Service Configuration Settings
      • MDS File-Based Authentication for Confluent Platform
    • Docker Operations for Confluent Platform
      • Overview
      • Monitor and Track Metrics Using JMX
      • Configure Logs
      • Mount External Volumes
      • Configure a Multi-Node Environment
    • Run Kafka in Production
    • Production Best Practices
  • Monitor
    • Logging
    • Monitor with JMX
    • Monitor with Metrics Reporter
    • Monitor Consumer Lag
  • Monitor with Health+
    • Overview
    • Enable
    • Intelligent Alerts
    • Monitor Using Dashboard
    • Configure Telemetry Reporter
    • Telemetry Reporter Metrics Reference
    • FAQ
  • Confluent CLI
  • Release Notes
    • Release Notes
    • Changelogs
  • APIs and Javadocs for Confluent Platform
    • Overview
    • Kafka API and Javadocs for Confluent Platform
      • Kafka Java Client APIs
      • Kafka Producer Java API
      • Kafka Consumer Java API
      • Kafka AdminClient Java API
      • Kafka Common Java API
      • Kafka Streams Java API
      • Kafka Connect Java API
    • Client APIs
      • Python Client API
      • .NET Client API
      • JavaScript Client API
      • Go Client API
      • C++ Client API
      • Java Client API
      • JMS Client
        • Overview
        • Development Guide
    • Confluent APIs for Confluent Platform
      • Overview
      • Confluent REST Proxy API
      • Connect REST API
      • ksqlDB REST API
      • Metadata API
      • Schema Registry API
  • Glossary

OAuth/OIDC Authentication in Confluent Platform

  • Overview
  • Claim Validation for OAuth JWT tokens
  • OAuth/OIDC Service-to-Service Authentication
  • Configure Confluent Server Brokers
  • Configure Confluent Schema Registry
  • Configure Metadata Service
  • Configure Kafka Connect
  • Configure Confluent Control Center
  • Configure REST Proxy
  • Configure Truststores for TLS Handshake with Identity Providers
  • Migrate from mTLS to OAuth Authentication

Was this doc page helpful?

Give us feedback

Do you still need help?

Confluent support portal Ask the community
Thank you. We'll be in touch!
Be the first to get updates and new content

By clicking "SIGN UP" you agree that your personal data will be processed in accordance with our Privacy Policy.

  • Confluent
  • About
  • Careers
  • Contact
  • Professional Services
  • Product
  • Confluent Cloud
  • Confluent Platform
  • Connectors
  • Flink
  • Stream Governance
  • Developer
  • Free Courses
  • Tutorials
  • Event Streaming Patterns
  • Documentation
  • Blog
  • Podcast
  • Community
  • Forum
  • Meetups
  • Kafka Summit
  • Catalysts
Terms & Conditions Privacy Policy Do Not Sell My Information Modern Slavery Policy Cookie Settings Feedback

Copyright © Confluent, Inc. 2014- Apache®️, Apache Kafka®️, Kafka®️, Apache Flink®️, Flink®️, Apache Iceberg®️, Iceberg®️ and associated open source project names are trademarks of the Apache Software Foundation

On this page: